MiCA & the End of the Transitional Period in Spain: What Every Business Should Review Before 1 July 2026

Spain’s transitional period under Regulation (EU) 2023/1114, known as MiCA (Markets in Crypto-Assets), will come to an end on 30 June 2026. From 1 July 2026 onwards, only providers holding the relevant authorisation, or otherwise entitled to operate under the applicable European framework, will be permitted to provide crypto-asset services in Spain.

This is not a minor regulatory change. It marks the end of a phase that, since MiCA became applicable, has allowed certain operators already providing services under the previous regime to continue operating while adapting to the new regulatory framework. Once the transitional period expires, entities that have not obtained the required authorisation will have to cease providing services or, where applicable, implement any required client migration and exit plans.

Authorisation as a Crypto-Asset Service Provider (CASP) is far more than a simple registration requirement. MiCA introduces a comprehensive framework covering supervision, internal organisation, solvency, custody arrangements, corporate governance, customer protection and operational risk management.

This new framework is already producing a clear consolidation effect. Operators with stronger financial, technical and regulatory capabilities are better positioned to obtain authorisation and continue their activities. Smaller platforms or those with less developed organisational structures may be forced to leave the market, integrate into authorised groups or completely redesign their business models.

For Spanish companies, the practical consequence is clear: the provider currently handling their crypto-asset operations, payments, custody arrangements or digital asset exposure could lose its ability to operate legally within a matter of days.

Obtaining a CASP licence requires compliance with a series of substantial requirements. Among other matters, the entity must have an appropriate legal and organisational structure, fit and proper directors, sufficient human and technical resources, internal control procedures, business continuity policies, complaint-handling mechanisms, anti-money laundering measures and systems designed to protect client assets.

Initial capital requirements vary depending on the services provided and may range from €50,000 to €150,000, without prejudice to the additional own-funds requirements established under MiCA. Authorisation also requires adequate segregation between the firm’s own assets and client assets, together with robust governance arrangements relating to custody, technological security and operational resilience.

Accordingly, this is neither a minor authorisation process nor an automatic regularisation mechanism. Applicants must prepare a complete technical, legal and operational dossier, and the duration of the process will depend on the complexity of the business model and any requests for additional information made by the supervisory authority.

One of the most common misconceptions is that MiCA only affects cryptocurrency exchanges. Its scope is considerably broader. The Regulation may apply to entities that provide custody services for crypto-assets on behalf of third parties, execute orders, manage portfolios, place crypto-assets, operate trading platforms or provide advice on crypto-assets.

Companies that have incorporated tokens, digital assets, crypto-asset payments or blockchain-based financing models into their activities should also pay close attention. Not every company using crypto-assets automatically requires CASP authorisation, but it is essential to analyse the specific service being provided, the parties involved, the degree of intermediation and the operational structure adopted.

In particular, companies working with stablecoins, electronic money tokens or other digital instruments linked to payment systems should assess whether, in addition to MiCA, they may also be subject to other financial authorisations, including payment services regulation where applicable.

From a corporate law perspective, the end of the transitional period does not only affect the crypto platform or operator itself. It also requires directors to act with enhanced diligence.

Continuing to provide regulated services without authorisation may lead to significant administrative sanctions and, depending on the circumstances, other civil, corporate or even criminal liabilities where additional conduct justifies such consequences. Furthermore, if non-compliance results in a disorderly shutdown of operations, client losses, insolvency or an inability to meet obligations, the actions of the management body may be scrutinised in any subsequent liability or insolvency proceedings.

For this reason, waiting until 1 July is not sufficient. Affected companies should be able to demonstrate that they have reviewed their situation, verified the authorisation status of their service providers, assessed risks affecting clients and counterparties, and adopted reasonable measures to avoid a disorderly interruption of business activities.

The CNMV has reminded providers that cannot continue operating that they must implement effective mechanisms allowing clients to withdraw funds, transfer crypto-assets to wallets or addresses of their choice, or migrate to authorised providers, always in compliance with anti-money laundering obligations and all other applicable regulations.

This point is particularly important. A migration plan is not a mere administrative formality; it is a key element of customer protection and orderly risk management. A lack of planning may increase the exposure of both the company and its directors, particularly where it results in financial losses, operational disruption or loss of access to assets.

Companies with direct or indirect exposure to crypto-assets should carry out an immediate review of their position. In particular, they should verify whether the providers they use hold CASP authorisation in Spain or a valid European passport, confirm whether contracted services will continue to be available after 1 July 2026, review custody agreements and contractual arrangements, identify operational disruption risks and document the decisions adopted by the management body.

For companies holding crypto-assets on their balance sheet, maintaining digital treasury positions, making payments through stablecoins, developing tokenisation projects, operating blockchain-based technology platforms or maintaining relationships with international exchanges, this review is not merely a regulatory exercise. It is a fundamental corporate governance and business diligence measure.

The change introduced by MiCA is not simply the introduction of a licensing requirement. It represents the extension of standards traditionally associated with the financial sector to the crypto-asset market: solvency, internal controls, transparency, customer protection and effective supervision. Companies that fail to adapt their processes in time may find themselves dealing with providers that cease operations, blocked transactions or legal risks that could have been anticipated and mitigated.

At ILIA ETL GLOBAL, we assist companies, directors and corporate groups with the legal, tax and regulatory review of structures involving crypto-assets, digital assets and emerging technology-driven business models. Our approach combines legal analysis with a practical business perspective, helping clients identify risks, organise their operations and make informed decisions before the MiCA framework becomes fully effective in Spain.

Article prepared by our colleague Xavier Vilalta.

To receive specialized advice on this matter, you may contact specialists at ILIA ETL GLOBAL, or alternatively reach out through our contact form.